Overview | Package | Class | Tree | Deprecated | Index | Help
| Bouncy Castle Cryptography Library 1.85
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.bouncycastle.math.ec.rfc7748
Class X25519

    java.lang.Object
      org.bouncycastle.math.ec.rfc7748.X25519

public abstract class X25519
extends java.lang.Object

A low-level implementation of X25519 (RFC 7748).

Algorithm map. `generatePrivateKey(java.security.SecureRandom, byte[])` — 32 random bytes followed by `clampPrivateKey(byte[])` (RFC 7748 sec. 5 clamping: clear bits 254..255 then 0..2, set bit 254). `generatePublicKey(byte[], int, byte[], int)` / `scalarMultBase(byte[], int, byte[], int)` — computed as on the birationally-equivalent curve via `Ed25519#scalarMultBaseYZ(Friend, byte[], int, int[], int[])` (a signed multi-comb in extended Edwards coordinates), then converted to the curve25519 coordinate using the RFC 7748 sec. 4.1 birational map where . `scalarMult(byte[], int, byte[], int, byte[], int)` (key agreement) — Montgomery ladder on XZ-only projective coordinates per RFC 7748 sec. 5, with per-bit constant-time ; the curve constant is precomputed from . The final three doublings correspond to the always-cleared low bits of the scalar; these clear the cofactor to ensure a non-twist result. `calculateAgreement(byte[], int, byte[], int, byte[], int)` — `scalarMult(byte[], int, byte[], int, byte[], int)` followed by the RFC 7748 sec. 6.1 all-zero rejection.

Side-channel scope. Secret-scalar operations are written to be constant-time at the Java level: the Montgomery ladder in `scalarMult(byte[], int, byte[], int, byte[], int)` performs identical field operations per bit with branchless ; `scalarMultBase(byte[], int, byte[], int)` routes through the Ed25519 signed-comb, which walks all precomputed entries with mask-based rather than a secret-indexed array load and applies conditional negation by XOR-with-mask; the final modular inverse uses constant-time . The all-zero rejection in `calculateAgreement(byte[], int, byte[], int, byte[], int)` runs an OR-accumulator and only leaks the RFC-mandated public rejection criterion. This is sufficient against a remote network timing attacker but is not a substitute for a constant-time native implementation against a co-located cache-line-resolution adversary — JVM-level timing variance from JIT, GC and cache eviction is not addressable in pure Java.

Nested Class Summary
`static class` | `X25519.Friend`

Field Summary
`static int` | `POINT_SIZE`
`static int` | `SCALAR_SIZE`

Constructor Summary
`X25519()`

Method Summary
`static boolean` | `calculateAgreement(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)`
`static void` | `clampPrivateKey(byte[] k)`
`static void` | `generatePrivateKey(java.security.SecureRandom random, byte[] k)`
`static void` | `generatePublicKey(byte[] k, int kOff, byte[] r, int rOff)`
`static void` | `precompute()`
`static void` | `scalarMult(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)`
`static void` | `scalarMultBase(byte[] k, int kOff, byte[] r, int rOff)`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### POINT_SIZE

    public static final int POINT_SIZE

See Also:
  Constant Field Values

### SCALAR_SIZE

    public static final int SCALAR_SIZE

See Also:
  Constant Field Values

Constructor Detail

### X25519

    public X25519()

Method Detail

### calculateAgreement

    public static boolean calculateAgreement(byte[] k,
                                             int kOff,
                                             byte[] u,
                                             int uOff,
                                             byte[] r,
                                             int rOff)

### clampPrivateKey

    public static void clampPrivateKey(byte[] k)

### generatePrivateKey

    public static void generatePrivateKey(java.security.SecureRandom random,
                                          byte[] k)

### generatePublicKey

    public static void generatePublicKey(byte[] k,
                                         int kOff,
                                         byte[] r,
                                         int rOff)

### precompute

    public static void precompute()

### scalarMult

    public static void scalarMult(byte[] k,
                                  int kOff,
                                  byte[] u,
                                  int uOff,
                                  byte[] r,
                                  int rOff)

### scalarMultBase

    public static void scalarMultBase(byte[] k,
                                      int kOff,
                                      byte[] r,
                                      int rOff)

Overview | Package | Class | Tree | Deprecated | Index | Help
| Bouncy Castle Cryptography Library 1.85
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD